PT-2025-39809

CVE-2025-11140

Published

2025-09-29

Updated

2026-10-09

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bjskzy Zhiyou ERP versions prior to 11.0

Description A flaw exists in Bjskzy Zhiyou ERP that could allow for remote manipulation. The issue is related to the openForm function within the com.artery.richclient.RichClientService component. Specifically, manipulating the contentString argument can lead to xml external entity reference. The exploit is publicly available.

Recommendations Update to a version of Bjskzy Zhiyou ERP greater than 11.0. As a temporary workaround, consider restricting access to the openForm function until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Nu11

Vendors

Affected products

Weakness enumeration

CWE-611: Improper Restriction of XML External Entity Reference

CWE-610: Externally Controlled Reference to a Resource in Another Sphere

Related identifiers